Deterministic and Efficient Quantum Cryptography Based on Bell's Theorem 
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(Dated:) 

We propose a novel double-entanglement-based quantum cryptography protocol that is both ef- 
ficient and deterministic. The proposal uses photon pairs with entanglement both in polarization 
and in time degrees of freedom; each measurement in which both of the two communicating parties 
register a photon can establish one and only one perfect correlation and thus deterministically create 
a key bit. Eavesdropping can be detected by violation of local realism. A variation of the protocol 
shows a higher security, similarly to the six-state protocol, under individual attacks. Our scheme 
allows a robust implementation under current technology. 

PACS numbers: 03.67.Dd, 03.65.Ud, 42.50.Dv 



Entanglement and nonlocality lie at the heart of mod- 
ern understanding of quantum foundations. One of the 
most striking aspects of entanglement is that certain sta- 
tistical correlations derived for entangled states can be 
in conflict with local realism ll| , as quantitatively shown 
by Bell's inequalities (BI) |2|. These fundamental is- 
sues were originally considered at the very boundary of 
physics and philosophy. Yet, they have found practical 
applications in quantum information science. In a re- 
markable paper by Ekert 3], BI have a profound utility 
in quantum cryptography (QC) (or, quantum key distri- 
bution, QKD) [J, la, la> 13 • Actually, there is a fascinating 
link 0, 0, H, Hj between security of certain quantum com- 
munication protocols and BI. However, quantum viola- 
tions of local realism also occur in an "all- versus- nothing" 
(AVN) form [H EJ 13 El , 

which is more striking in the 
sense that the contradiction between quantum mechanics 
and local realism arises even for definite correlations. It 
thus remains to be seen if such an AVN nonlocality can 
have any application in quantum information, particu- 
larly, in QC. Most of the QC protocols 0, 0, |H Pro- 
posed so far are non-deterministic as only less than 50% 
qubits detected can be further used as key bits. This may 
be a practical problem, e.g., in the one-time-pad secret- 
key cryptosystem • Such a problem may be eliminated 
by deterministic QC protocol and secret direct commu- 
nication, which attracted some recent interest |14l Il5| . 

For QC experiments realized with faint laser pulses, 
they may be insecure under the so-called beamsplitter 
(BS) attack 0. This is because the currently available 
photon sources have a finite probability of emittting more 
than one photon (or more than one entangled photon pair 
for entangled photon sources). An eavesdropper (usually 
called Eve) could in principle use a channel with lower 
photon loss or without loss and only allow those attenu- 
ated pulses containing n (n > 2) photons to reach the re- 
ceiver. For these pulses she can use a BS to steal at least 
one photon, thus getting full information without being 
detected. However, the entanglement-based QC proto- 
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FIG. 1: A proposed implementation of our QKD protocol. 



cols (such as Ekert 's H and ours to be described below) 
exploit entanglement as certain "security resource" and 
do not suffer from this kind of problem as the security 
therein is guaranteed by the violations of BI. 

In this paper, based on the previously proved two- 
party AVN nonlocality (or inseparability) for two doubly- 
entangled photon pairs 0] , we propose a novel QC pro- 
tocol which is efficient and deterministic: Each detected 
photon pair can establish a key bit with the help of clas- 
sical communications. This deterministic feature of our 
protocol stems from the very nature of the two-party 
AVN nonlocality: The two communicating parties always 
have perfect quantum correlations for whatever measure- 
ment bases they choose. An eavesdropper can be de- 
tected by observing the violation of local realism for the 
quantum channel. A variation of the present protocol is 
similar to the six-state protocol 0] and shows a higher 
security under simple individual attacks. A remarkable 
advantage of the present scheme is that all required mea- 
surements can be done with linear optical elements and 
as such, the experimental realization of the protocol is 
within the reach of current technology. 
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In our protocol (see Fig. 1) "doubly-entangled" photon 
pairs (photon-1 and photon-2) in the state 

I*)i2 = \i\ H )i \ H )i + \V)i I^) 2 )(IT) 1 IT) 2 + \i) 2 ) 

(1) 

are generated via spontaneous parametric down conver- 
sion (SPDC) and sent, respectively, to two communica- 
tors, Alice and Bob. Here \H) (\V)) stands for photons 
with horizontal (vertical) polarization; |f) and \l) span 
an orthonormal basis for either time or path states of 
photons. \^)i2 is maximally entangled both in polar- 
ization and in time/path degrees of freedom of photons. 
The creation of polarization-path entanglement was dis- 
cussed in hlhj. With a pump interferometer in Fig. 1 
one can generate polarization-time double entanglement 
(More details are given at the end of this paper). 

To create secure keys, each party needs to measure ob- 
servables involving the spin- type operators x = \H) (V\ + 
\V)(H\, z = \H)(H\ - \V)(V\ (for polarization) and 
x' = IT) (II + II) <T|, * = IT) (Tl - II) (II (for time/path). 
Particularly, the two parties should measure nine observ- 
ables: 
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(2) 

Here Alice (Bob) arranges her (his) local observables into 
three groups Ai, A 2 and A 3 (Bi, B 2 and B 3 ), each of 
which has three operators. As in Ref. 13], the three 
operators of each group can be measured by one and the 
same apparatus (to be described below). This is crucial 
in the AVN argument of nonlocality without the nece ssity 
of an additional assumption of noncontextuality |l3l Il8| . 
When measuring the three operators of each group, e.g., 
Ai (other groups are similar), one measures Zi and x[ 
simultaneously with the apparatus (also labeled as Ai), 
thus also giving the measurement result of z\ ■ x[ , which 
is just the product of the readouts of z\ and x' x . To 
denote this fact we then use (•) to separate operators 
(as in z\ ■ x[, x\ ■ z[, x% ■ x' 2 and Z2 ■ z 2 ) or operator 
products (as in ziz[ ■ X\x' x and Z2x' 2 ■ X2z' 2 ) that can be 
identified as local "elements of reality" in the nonlocality 
argument 13]. In this way, the three operators in each 
group are co-measurable and measured simultaneously 
by the same apparatus. Totally, one thus requires six 
apparatuses (A\, A 2 and A 3 for Alice; Bi, B 2 and B 3 for 
Bob), which can be realized without any mutual conflict 
only by linear optical elements [l3j ]. 

Now we are ready to describe the present QC protocol. 
For each of the emitted pairs, photon-1 (photon-2) goes 
to Alice (Bob) who then measures an operator group, 



which is chosen randomly and independently from the 
three groups A%, A 2 and A 3 (B\, B 2 and B 3 ). Any local 
outcome of the above measurements is completely ran- 
dom and can of course be either —1 or +1, representing 
thus one bit of information. 

Now one immediately has the following: For each pair 
of operator groups chosen by Alice and Bob, there is one 
and only one pair of outcomes of the local operators (or 
operator products) that possesses perfect correlation; to- 
tally Alice and Bob can establish nine pairs of perfectly 
correlated local outcomes as each of the two parties has 
three operator groups. For instance, if Alice (Bob) mea- 
sures the three operators in A% (B2), then only the out- 
comes of z± and Z2 will show perfect correlation, i.e., their 
product will certainly be 1. The above result stems from 
the fact that for the photon pair s in | V E') 12 one has the 
following nine eigenequations |13| 



Z l -Z 2 |*) 12 - 1, 


A ■ A |*) 12 - 1) 






(3) 


xi ■ x 2 |*) 12 = 1, 


X\ ■ x 2 ||*) l2 = 1, 
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= 1, 
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zi ■ x[ ■ z 2 x 2 |^ )i2 


= 1, Xi ■ z[ ■ x 2 z 2 


ll*>« 


= 1, 


(6) 


Ziz[ ■ X\x\ ■ Z2X 2 ■ 


X2A l*) 12 = -1. 






(7) 



Here we have used a simplification in notions, e.g., Zi ■ 
Zi ||*) 12 = 1 means z\ ■ z 2 |*) 12 = |*) 12 - 

After the above measurements have taken place on 
a photon pair, Alice and Bob can announce in public 
by classical communications which of the three operator 
group they have measured. They discard all measure- 
ments in which either or both of them fail to register a 
photon at all. In the case where Alice and Bob have de- 
tected a photon simultaneously from the emitted photon 
pairs, they can establish deterministically a secure key as 
they can know from the classical communications which 
pair of their outcomes has perfect correlation. For ex- 
ample, let us again assume that Alice (Bob) has chosen 
the apparatus A\ (B 2 ). In this case the two parties will 
certainly obtain Z\ ■ Z2 = 1, from which Alice using 

her own outcome of z\ can predict with certainty Bob's 
outcome of z 2 , and vise versa. Any one of this type of 
perfect correlations can then be used to create determin- 
istically a secure key bit. The deterministic feature of 
our QC protocol is thus demonstrated. As a comparison, 
Ekert's protocol is nondeterministic in the sense that suc- 
cessful detection of a photon by both Alice and Bob can 
establish at most 2/9 raw key. 

All QKD protocols are consisted of two parts: the 
quantum part producing the raw keys and the classical 
part (e.g., reconciliation and privacy amplification) 0. 
The later is not considered here as it is the same for all 
cryptographic protocols . Now it is ready to see that 
our protocol is more effective than traditional protocols 
(e.g., Ekert's protocol) in the quantum part. For com- 
parison, in Ekert's protocol 7/9 of detected photon pairs 
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is of no use for establishing raw keys and will be sacrificed 
to detect eavesdropping. Thus, in the quantum part our 
protocol is 1/(1 — 7/9) = 4.5 times more efficient than 
the original Ekert protocol. 

A complete security analysis of our QKD protocol is 
very difficult and beyond the scope of this paper. Here 
we consider the security issue by first following Ekert 's 
security analysis ||. In Ekert 's protocol, the presence 
of an eavesdropper can be detected in conjunction with 
BI. This is because a possible intervention (interception, 
detection, and substitution of photons) by the eavesdrop- 
per is equivalent to introducing local elements of physical 
reality into the system. Following this line of thought, 
Eve's intervention would acquire information, e.g., by 
randomly measuring observables like A S {A\, A2, A%} 
and B E {Bi, B 2 , B3} with certain results (denoted by 
A); afterwards she sends the replacement of the detected 
photons to Alice and Bob. Now what Alice and Bob do 
is just to measure certain predetermined values of these 
operators (i.e., elements of physical reality) as measured 
already by Eve. In this case, Alice and Bob would obtain 
the correlation Ea-b — J cI\p(X)Ea(X)Eb(X), where the 
integration may also be summation if the number of A is 
finite and p(A) is the probability for Eve's result A. Thus, 
in the presence of Eve, one has 0, H^j ] 

(®) Eve ~ J d\p{X) \^E ZlZ ^. XlX ^. Z2X ^. X2Z ^ + E ZlZ ' i . Z2 . z ' 2 

~t~ ^X\X' 1 -X2-X , 2 "f" ^Zi-x' 1 -Z2X f 2 ~t~ ^XI-Z' 1 -X2Z' 2 

+E Zl . Z2 + E z ' ± . z > 2 + E Xl . X2 + Ex'^x^] < 7. (8) 

Here E A . B = [C(A-B = +1)-C{A-B = -1)}/[C(A-B = 
+l) + C{A-B = -1)], where C(A-B = ±1) are the count- 
ing numbers when the measured variable A-B = ±1. The 
measured nine sets of perfect correlations allow Alice and 
Bob to infer Ea-b in © and, then, (0) Eve . The observed 
violation of JHJ can thus detect Eve's eavesdropping by 
randomly choosing a small portion ( "fair sample" ) of the 
generated key bits. Note that quantum prediction of the 
upper bound of © can be 9 [12L Il3| , as can be seen from 
Eqs. ©-0. 

The present scheme for detecting the eavesdropper is 
conceptually striking in the following sense. In Ekert's 
protocol, perfect correlations are used to establish se- 
cure keys, while statistical correlations are used to detect 
eavesdropping in terms of BI. However, in our protocol 
perfect correlations play the dual role of both establish- 
ing secure keys and detecting eavesdroppers. We have 
thus demonstrated the link for the security against eaves- 
dropping of our protocol and a two-party version of Bell's 
theorem, and the definite quantum predictions used in a 
two-party AVN nonlocality argument may have fascinat- 
ing application in the deterministic QKD protocol. 

Note that \^) 12 is a maximally entangled state in a 4®4 
dimensional Hilbert space 01 • To achieve higher security 
in QKD protocols, one may use either high-dimensional 



systems Il9l or more alternative settings (e.g., three-base 
protocol [16|). Thus one might expect that our QKD 
protocol using three measurement bases per party and 
high-dimensional entanglement has a bonus of higher se- 
curity. To show that this is indeed the case, recall that 
Ekert's protocol can be regarded as a variation [5j of 
the BB84 protocol 0, and as such the security of the 
former can be guaranteed by the security of the latter. 
Similarly, let us consider the case where Alice prepares 
the doubly-entangled pair herself, measures one of her 
three operator groups in (J2J), and sends to Bob photon-2, 
which might be subject to Eve's intercept-resend attacks. 
This modified protocol is then, in some sense, similar to 
the six-state (three- base) protocol which is more 

secure than the origianl BB84 protocol. For instance, 
when Alice measures Ai, she will collapse her state onto 
the basis vectors \H) 1 |f) 1 {z\ — l,x[ = 1) or \V) 1 |J) 
(zi = — l,x\ = —1) for which z\ ■ x[ = 1, or \H) 1 |J) 
( Zl = l,x[ = -1) or \V) 1 I f >i («i = -l,x[ = 1) for 
which zi • x[ = -1. Here ||) = ^ (|T) + ID) and 
|I) = TsdT) - U». If Alice gets \H) 1 | f > x (with the 
probability of 1/4), Bob's state will be equivalently pre- 
pared as \H) 2 |f) 2 ' which is exactly the equal-amplitude 
superposition of the basis vectors for any of {Bi, B 2 ,B 3 }. 
Note that any two basis vectors \ e a ) and |e^) belonging to 
different bases in {B\, B 2 , B 3 } satisfy \{ep |e Q )| 2 = 1/4, 
i.e., the three bases {-Bi, B 2 , B3} are mutually unbiased. 
If Eve, with the probability of 2/3, uses wrong bases, she 
gets wrong perfect correlations with Alice and thus no 
information. Explicit calculation shows that Eve can be 
detected with the probability of 1/2 in this case. Thus 
Bob's error rate under the simple individual attacks is 
1/3, implying that our protocol might be more secure, 
similarly to the six-state protocol, but eliminates the lat- 
ter's disadvantage of low efficiency. 

A recent experiment [2(j (see also |2l|) has success- 
fully created the path-polarization-entangled two-photon 
states. Note that the two photons experiences two differ- 
ent paths from the source to the detectors. Then the co- 
herence of the path entanglement will be sensitive to the 
relative phase that a photons would acquire as it propa- 
gates along the two paths. The unavoidable fluctuations 
in the relative phase may destroy the path entanglement. 
To maintain the path coherence, especially in the long- 
distance case, the long-distance intcrfcrometric stability 
is required, which is extremely difficult in practice. 

Fortunately, one can overcome the above problem by 
using pulsed entanglement source where the two photons 
are entangled both in time (i.e., time-bin entanglement 
[22I |23| ) and in polarization. To create the required en- 
tanglement, a short, ultraviolet (UV) laser pulse is sent 
first through an unbalanced Mach-Zehnder interferome- 
ter (the pump interferometer) and then through a BBO 
crystal (see Fig. 1). The pump pulse is splitted by the 
first (50%-50%) BS (BS1) into two pulses, one propa- 
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gating along the short path and another along the long 
path. If the pulse duration is shorter than the arm length 
difference, the output from (50%-50%) BS2 is two pulses 
well separated in time. For the case where there is one 
and only one polarization-entangled pair [assumed to be 
in -i=(|iJ) 1 \H) 2 + \V) 1 \V) 2 ) for defmiteness] production 
after the "early" and "late" pulses pass through the BBO 
crystal, the polarization-time entangled two-photon state 
|*) 12 = i(|if) x \H) 2 + \V) t ItOaXle)! |e) 2 + [l), \l) 2 ) is 
then created by adjusting the phase cb. Here |f) = |e) 
(early time) and |J.) = \l) (late time) are two orthonor- 
mal time states of photons. In Fig. 1 the pulse time 
detector can determine the emission time of the pump 
laser, giving a time fiducial signal. 

Now each photon hold by Alice or Bob propagates 
along the same path. In this way, the time-entanglement 
is much more robust than the path-entanglement. In- 
deed, time-bin entanglement has been experimentally 
distributed over 50 km in optical fibers |23l. However, 
time-bin measurement is non-deterministic |22_ l23j and 
may thus reduce the efficiency of the key production. 

Here we propose a measurement scheme with simple 
linear optical elements and fast switches. The setup in 
Fig. 1 can measure all local observables in (J2J) by using 
two "time-path transmitters" (TPT) with optical paths 
identical to the pump interferometer. In the TPT a fast 
swith will reflect an incident photon into the long path of 
the TPT only for photons in |e); otherwise, it is swithed 
off so that the \l) photons simply propagate along the 
short path of the TPT. The fast swith is controlled ac- 
cording to the timing of the pulsed photons by noting 
that |e) and \l) are two time states distinguishable with 
respect to the time fiducial signal (see Fig. 1). In this 
way, the TPT transforms coherently |e) to \d) (\u)), 
with \d) and \u) being two distinguishable paths of pho- 
tons. Afterwards, all measurements in @ can be done 
by the linear optics setups in Ref. |l3|. 

The function of a fast switch can be accomplished by 
an acousto-optic modulator (AOM). Due to bulk acousto- 
optic interaction, an incident laser beam can be either 
diffracted ( "first order" ) by or directly transmitted ( "zero 
order" ) through an acousto-optic medium, depending on 
whether the acoustic wave is present or not. Thus, if 
e) (\l)) is subject to the first-order (zero-order) process, 
|e) and \l) will be separated in path, acting exactly as 
a TPT. The intensity change (the wavelength change 
can be safely neglected) between the zero-order and first- 
order beams may be compensated by an attenuator. The 
current commercial AOM [24| can reach a rising time of 
about several nanoseconds, which is sufficient enough for 
our proposal. Moreover, it was already used as a fast 
optic switch (On/Off), e.g., by Kuzmich et al. [24| for 
generating nonclassical photon pairs. 

To summarize, we have proposed a double- 
entanglement-based QC protocol that is both efficient 



and deterministic. The deterministic feature and high 
efficiency of our protocol have obvious advantages in a 
practical utility. Importantly, our protocol is within the 
reach of current technology and even allows a robust 
intermediate-distance realization. 

Note added in proof. — Recently, M. Genovese kindly 
informed us their related work (Ref. 25) using path-time 
double entanglement in nondeterministic QKD. 
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